CVE-2026-30239 in openproject
Summary
by MITRE • 03/11/2026
OpenProject is an open-source, web-based project management software. Prior to 17.2.0, when budgets are deleted, the work packages that were assigned to this budget need to be moved to a different budget. This action was performed before the permission check on the delete action was executed. This allowed all users in the application to delete work package budget assignments. This vulnerability is fixed in 17.2.0.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 03/14/2026
The vulnerability described in CVE-2026-30239 represents a critical access control flaw within the OpenProject project management platform that existed prior to version 17.2.0. This issue stems from a fundamental misconfiguration in the permission validation workflow during budget deletion operations, creating an exploitable condition that undermines the software's authorization mechanisms. The vulnerability specifically affects the relationship between budget management and work package assignment functionality, where the system fails to properly enforce user permissions before executing destructive operations.
The technical flaw manifests in the sequence of operations during budget deletion where the system performs the cleanup action of moving work packages to alternative budgets before validating whether the user possesses adequate permissions to delete the budget in the first place. This ordering issue creates a window of opportunity for unauthorized users to manipulate budget assignments without proper authorization. According to CWE classification, this vulnerability aligns with CWE-284 Access Control Issues, specifically manifesting as insufficient authorization checks during critical operations. The flaw represents a classic case of privilege escalation through improper access control implementation, where the system's permission model is bypassed through a timing attack on the validation process.
The operational impact of this vulnerability extends beyond simple unauthorized access, as it fundamentally compromises the integrity of project financial tracking and resource allocation within OpenProject environments. Any user within the application can exploit this weakness to remove budget assignments from work packages, potentially leading to financial data corruption, unauthorized resource reallocation, and disruption of project costing methodologies. This vulnerability affects organizations that rely on OpenProject for project management and financial oversight, as it undermines the trustworthiness of budget-related data and could lead to compliance issues in regulated environments. The impact is particularly severe in organizations where budget tracking is critical for reporting and audit purposes, as unauthorized deletions could result in missing or altered financial records that are essential for project accountability.
From a threat modeling perspective, this vulnerability maps to several ATT&CK techniques including TA0004 Privilege Escalation and TA0003 Persistence, as unauthorized users could potentially establish persistent access patterns through budget manipulation. The vulnerability's exploitation requires minimal technical skill and can be automated, making it particularly dangerous in multi-user environments. Organizations should consider implementing additional monitoring around budget assignment changes and work package modifications as a compensating control. The fix implemented in version 17.2.0 addresses the root cause by reordering the validation process to ensure proper permission checks occur before any destructive operations are executed. Security practitioners should prioritize patching this vulnerability and conduct thorough audits of budget-related activities to identify any potential exploitation that may have occurred before the fix was applied.